Scanning content for abuse

In our exploration of new security companies focused on internal network threats, last week we looked at Lancope, which provides security tools to battle the bogeys that get past your perimeter defenses. This week we take a look at Reconnex, which is focused on what founder and CEO Don Massaro calls information security.

“Instead of looking at packets and trying to detect viruses and so on, we examine the content on your network looking for abnormalities, violations of security, violations of privacy and compliance,” Massaro says.

The year-old company began shipping its G2 Content Analyzer in March. The device sits on the spanning port of a router or internally on a switch, pulls off packets and reassembles them into TCP sessions, and then identifies the objects within, whether they be Word documents, PowerPoint files, Excel spreadsheets or instant messages.

“Then we analyze the contents looking for key words, key phrases, key expressions, water marks, document biometrics, whatever triggers the customer wants,” he says. The triggers selected depend on the issue being addressed, such as network abuse, compliance or protecting electronic assets.

Massaro gives the example of a CFO of a public company doing financial earnings projections. He might want to look at any document, attachment or instant message that contains the words “estimated earnings” to ensure information isn’t leaking to outsiders.

In this case, the highest level of security is achieved by registering earnings documents with the G2, which generates multiple signatures that can be used to trip an alarm. The signatures are based on a plagiarism algorithm so even if the contents are not identical they are likely to be spotted.

The device has been installed at 20 accounts that are using it to do everything from looking for project code words and source code to watching communications between employees and financial analysts.

Massaro says the key difference between his company’s product and those of competitors is the ability to run at line speed: It comes with dual-gigabit interfaces.

A fully loaded appliance costs $60,000, but the company sells a $10,000 analysis service through which it installs a box and generates an executive report examining the findings. That makes it easier to justify, Massaro says. Large customers might need five to 20 boxes for full coverage.

What is increasingly clear as companies such as Lancope and Reconnex enter the security fray is that there is no silver bullet. Defense in depth is still the best approach, and now that we recognize that perimeter defenses only take us so far, internal security has a role to play.